Hacker News new | ask | show | jobs
by nobody9999 1164 days ago
>Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware.

What evidence do you have for this? Not being snarky, as I have a whole bunch of WD drives.

Please do tell. Thanks!
2 comments
rasz 1164 days ago
2015 https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-se...

2017 https://www.bleepingcomputer.com/news/security/owners-of-wdt...

2017 https://blog.exploitee.rs/2017/hacking_wd_mycloud/

2018 https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_back... https://www.bitdefender.com/blog/hotforsecurity/researcher-f... https://www.techpowerup.com/240306/western-digital-ships-som...

"However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue."

link
nobody9999 1163 days ago
Thanks!

That's not very flattering, and if I used any of those products/software features (I have only bare, internal SAS drives, both spinning rust and SSD) I'd be really concerned.

Since I only use bare internal drives, I imagine I'm not at risk (although, I've had one or more of these drives for at least 7 or 8 years -- so if I was at risk, you'd think that would have happened already) from the vulnerabilities noted in the links you provided.

But I'll do some research (although I do try to keep track of such things and never heard anything about actual drive firmware -- rather than the NAS/cloud products -- being compromised.) anyway.

Thanks again for compiling these links and sharing them. Much appreciated!

link
DANmode 1164 days ago
Have you used their software?
link
nobody9999 1164 days ago
No. I always format every hard drive I buy, but GP asserted that their firmware has likely been compromised for years.

That's a strong statement, unsupported by, well, anything.

Not saying it isn't true -- and if it is, I want to know about it -- as it puts my systems at risk.

link
djbusby 1164 days ago
Crappy don't necessarily mean security-compromised
link
DANmode 1164 days ago
But it is a smell.
link